enigma-cli 1.37.0 → 1.37.1

package/assets/registry/primitives/registry.json

@@ -155,8 +155,8 @@
     },
     {
       "name": "input",
-      "title": "Input, with what a password field needs",
-      "description": "A field you pass props to, with no styles of its own. A password gets its reveal toggle automatically; a generator, a strength meter and a breach check are one prop each and off until you ask. React renders every part of it, so nothing fights your tree.",
+      "title": "Input, one field for every type",
+      "description": "A field you pass props to, typed by its `type`: password gets the reveal toggle, a generator, a strength meter and a breach check; search gets debouncing, ranking and a clear button; everything else is a plain field with native props. What each type needs is loaded when that type is used, so a form of text fields ships none of it.",
       "targets": [
         "vanilla",
         "astro",
@@ -165,7 +165,7 @@
       "entry": {
         "vanilla": "@enigmax/primitives",
         "astro": "@enigmax/primitives",
-        "react": "@enigmax/primitives/react"
+        "react": "@enigmax/primitives/react/input"
       },
       "exports": {
         "vanilla": [
@@ -181,17 +181,28 @@
       },
       "files": [
         {
-          "path": "src/core/input.ts",
-          "dest": "input/input.ts",
+          "path": "src/core/input-icons.ts",
+          "dest": "input/input-icons.ts",
           "targets": [
             "vanilla",
             "astro",
             "react"
           ]
         },
+        {
+          "path": "src/core/input.ts",
+          "dest": "input/input.ts",
+          "targets": [
+            "vanilla",
+            "astro"
+          ],
+          "rewrite": {
+            "@/core/input-icons": "./input-icons"
+          }
+        },
         {
           "path": "src/core/password.ts",
-          "dest": "input/password.ts",
+          "dest": "input/password-core.ts",
           "targets": [
             "vanilla",
             "astro",
@@ -199,13 +210,56 @@
           ]
         },
         {
-          "path": "src/react/use-input.ts",
-          "dest": "input/use-input.ts",
+          "path": "src/core/search.ts",
+          "dest": "input/search-core.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/input/types.ts",
+          "dest": "input/types.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/search": "./search-core",
+            "@/core/password": "./password-core"
+          }
+        },
+        {
+          "path": "src/react/input/icon.tsx",
+          "dest": "input/icon.tsx",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/input/write-value.ts",
+          "dest": "input/write-value.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/input/password.tsx",
+          "dest": "input/password.tsx",
           "targets": [
             "react"
           ],
           "rewrite": {
-            "@/core/input": "./input"
+            "@/core/password": "./password-core",
+            "@/react/input/types": "./types"
+          }
+        },
+        {
+          "path": "src/react/input/search.tsx",
+          "dest": "input/search.tsx",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/search": "./search-core"
           }
         },
         {
@@ -219,15 +273,20 @@
           "style": "css"
         },
         {
-          "path": "src/react/input.tsx",
+          "path": "src/react/input/index.tsx",
           "dest": "input/index.tsx",
           "main": true,
           "targets": [
             "react"
           ],
           "rewrite": {
-            "@/core/input": "./input",
-            "@/core/password": "./password"
+            "@/react/input/icon": "./icon",
+            "@/react/input/write-value": "./write-value",
+            "@/core/input-icons": "./input-icons",
+            "@/react/input/types": "./types",
+            "@/react/input/password": "./password",
+            "@/react/input/search": "./search",
+            "@/core/password": "./password-core"
           }
         },
         {
@@ -262,7 +321,8 @@
         "[data-enigma-password-strength-segment]",
         "[data-enigma-password-strength-segment][data-filled]",
         "[data-enigma-password-strength-label]",
-        "[data-enigma-password-strength-warning]"
+        "[data-enigma-password-strength-warning]",
+        "[data-enigma-input-action=clear]"
       ],
       "docs": "docs/notes/primitives.md#input",
       "recipes": [
@@ -273,7 +333,7 @@
     {
       "name": "search",
       "title": "Search as you type",
-      "description": "Search as you type, fuzzy by default with Fuse.js. Debouncing, ranking and cancellation are the primitive's; the matching is replaceable, and dropping Fuse falls back to a built-in accent-insensitive substring matcher.",
+      "description": "The engine behind `<Input type=\"search\">` and the palette: debouncing, ranking and cancellation, fuzzy with Fuse.js or a built-in accent-insensitive substring matcher with no dependency at all.",
       "targets": [
         "vanilla",
         "astro",
@@ -282,7 +342,7 @@
       "entry": {
         "vanilla": "@enigmax/primitives/search",
         "astro": "@enigmax/primitives/search",
-        "react": "@enigmax/primitives/react"
+        "react": "@enigmax/primitives/react/search"
       },
       "exports": {
         "vanilla": [
@@ -413,14 +473,111 @@
         "[data-loading]",
         "[data-cooldown]",
         "[aria-disabled=true]",
-        "[aria-busy=true]"
+        "[aria-busy=true]",
+        "[data-enigma-button-key]"
       ],
       "docs": "docs/notes/primitives.md#button"
     },
+    {
+      "name": "palette",
+      "title": "Command palette",
+      "description": "Ctrl/Cmd+K, search as you type, what was searched before, groups, and every key a palette is expected to answer to. A dialog made of parts you can compose or take whole, with the focus trap, the scroll lock and the listbox wiring already right.",
+      "targets": [
+        "react"
+      ],
+      "entry": {
+        "react": "@enigmax/primitives/react/palette"
+      },
+      "exports": {
+        "react": [
+          "SearchPalette"
+        ]
+      },
+      "files": [
+        {
+          "path": "src/core/palette.ts",
+          "dest": "palette/palette.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/search.ts",
+          "dest": "palette/search-core.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/slot.tsx",
+          "dest": "palette/slot.tsx",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/palette/context.ts",
+          "dest": "palette/context.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/palette": "./palette",
+            "@/core/search": "./search-core"
+          }
+        },
+        {
+          "path": "src/react/palette/root.tsx",
+          "dest": "palette/root.tsx",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/palette": "./palette",
+            "@/core/search": "./search-core",
+            "@/react/slot": "./slot",
+            "@/react/palette/context": "./context"
+          }
+        },
+        {
+          "path": "src/react/palette/index.tsx",
+          "dest": "palette/index.tsx",
+          "main": true,
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/react/palette/root": "./root",
+            "@/react/palette/context": "./context"
+          }
+        }
+      ],
+      "styles": false,
+      "themeHooks": [
+        "[data-enigma-palette-trigger]",
+        "[data-enigma-palette-trigger-key]",
+        "[data-enigma-palette-overlay]",
+        "[data-enigma-palette-content]",
+        "[data-enigma-palette-title]",
+        "[data-enigma-palette-field]",
+        "[data-enigma-palette-list]",
+        "[data-enigma-palette-group]",
+        "[data-enigma-palette-group-label]",
+        "[data-enigma-palette-item]",
+        "[data-enigma-palette-item][data-active=true]",
+        "[data-enigma-palette-item][data-kind=recent]",
+        "[data-enigma-palette-item-label]",
+        "[data-enigma-palette-item-description]",
+        "[data-enigma-palette-empty]",
+        "[data-enigma-palette-footer]",
+        "[data-enigma-palette-hint]"
+      ],
+      "docs": "docs/notes/primitives.md#palette"
+    },
     {
       "name": "flags",
       "title": "Country flags",
-      "description": "A flag as an image, from the CDN or from files you downloaded, in the rectangular set or the round one. Emoji flags are the thing this replaces: Windows ships no glyph for them, so a picker built out of emoji renders as bare letters for most desktop readers.",
+      "description": "A flag as an image, served by enigma or from files in your project, rectangular, square or round. It names itself in the reader's language, and accepts the emoji flag it replaces as its code - Windows ships no glyph for those, so a picker built out of emoji renders as bare letters for most desktop readers.",
       "targets": [
         "vanilla",
         "astro",
@@ -429,7 +586,7 @@
       "entry": {
         "vanilla": "@enigmax/primitives",
         "astro": "@enigmax/primitives",
-        "react": "@enigmax/primitives/react"
+        "react": "@enigmax/primitives/react/flag"
       },
       "exports": {
         "vanilla": [

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -7,6 +7,6 @@
     "codeGraph"
   ],
   "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -23,7 +23,7 @@ description: Frontend architecture - reusable components, abstraction thresholds
 
 ## Headless Primitives Before Hand-Rolled Interaction
 
-- Interaction logic - looping/draggable rows, momentum, focus traps, virtualized lists, dismiss timers, read caches - is BEHAVIOR, and behavior that has already been measured and tested is a dependency, not a snippet to rewrite. Check the catalogue before writing it: `enigma add` lists it, `enigma add <name>` adds it as a dependency, `enigma add <name> --copy` vendors the source in when it must be edited.
+- Interaction logic - looping/draggable rows, momentum, focus traps, virtualized lists, dismiss timers, read caches - is BEHAVIOR, and behavior that has already been measured and tested is a dependency, not a snippet to rewrite. Check the catalogue before writing it: `enigma add` lists it and `enigma add <name>` adds it as a DEPENDENCY, which is how you use these - the package keeps getting fixes and a dependency is how they reach the project. `--copy` vendors the source and freezes it at that version; reach for it to EDIT a component, never as the normal way to add one.
 - These primitives ship NO visual styles. They apply only what the behavior requires (overflow, touch-action, user-select, will-change, transform) and publish their state as `data-*` attributes, so the look stays entirely yours.
 - Do not hand-roll one of them "just for this page". The hand-rolled version is where the measured bugs come back: a duration-driven marquee that accelerates as items are added, a `setPointerCapture` drag that silently stops every link in the row from opening, a hover slowdown that sticks forever after the first tap because touch never fires `pointerleave`.
 - If the catalogue has no primitive for what you need, write it as one (core + adapter + registry entry + test) rather than inline in a page, so the next screen reuses it instead of rewriting it.

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
   "updated": "2026-08-31T02:47:20+02:00",
-  "cliVersion": "1.37.0",
-  "sha": "682be5335e0c761c6aa56e8d4825dec0821ca7875e0684b3cdfcc856bc750a2f"
+  "cliVersion": "1.37.1",
+  "sha": "13689bf1abc873fa4dd4241658b0552ab96870cca4e091aa2f89831051bcc616"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-08-22T09:25:34+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "cb320a6a5fd3279604ad7920b877c1a36e48f4f39aeead1a4c4daa89901d9ce0"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "0270c33d2b4559e831aec794c188d293d26fc17e2a8064a967d716ceb3a7bab6"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "a5a228a302f50d975a947b9d84676b4c2a4780f2b222f819388cc98d6a12f207"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.37.0",
+  "cliVersion": "1.37.1",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "91724cb93f5ac7a8c5f2ca04f21433abbd8a18c4924cbab325bfb125c8dad63b",
-  "enigma-linux-arm64": "62a1f86c6ed33b606a4064dd3565925e09cd6707781308aa568b5381edee0cb2",
-  "enigma-linux-x64": "7c4f3f47140040d48fcbe44ffe7d7f31eeb0b6e50b3f17a3c5cbec4b8dc25eb7",
-  "enigma-win32-x64.exe": "37532ee23b065e1a40d2410a7e548c7c3186f560bc989b04db5c429aa319356a"
+  "enigma-darwin-arm64": "3c011a7265b40a1a8e80dd198ffa2d422752df227732f4de28a4c88a25839596",
+  "enigma-linux-arm64": "714224e6bd93a8505a79e029b28cc9edb5d8925171ff7050e4a03b61830da9eb",
+  "enigma-linux-x64": "933e61c9bd8ecd1b86b61bbe149d00f33bb39fe6b00f73b1d4791b95d225f67c",
+  "enigma-win32-x64.exe": "769b6604325109f844e1ce8f61d0725dc654fca9e4e338f2fc39174d11605680"
 }

package/dist/guardrails.js

@@ -329,6 +329,31 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "validation-policy"
   },
+  {
+    id: "fe-new-password-affordance-on-signin",
+    label: "The strength meter belongs on a new password, not on sign-in",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.html", "*.htm"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    fileCheck: "fe-new-password-affordance-on-signin",
+    message: 'A new-password affordance on a sign-in form. The five-bar strength meter, the generator and the breach check exist for a form that CREATES a password - registration, a reset, a change-password screen - and each is wrong here in its own way: the meter scores a password the visitor already has and cannot change from this screen, so it is noise at best and an accusation at worst; the generator offers to replace the one they are trying to type; and the breach check sends a hash of a real credential on every sign-in attempt. What DOES belong on sign-in is the same format VALIDATION the creation form applied - minimum length, the character rules, the normalizer - because a password that cannot satisfy the rules it was created under cannot be the right one, so the client refuses to send it and the server never sees the attempt. Keep the validation and the reveal toggle; drop the meter, the generator and the breach check. The file says which side it is on through `autocomplete="current-password"`; a change-password screen carries a `new-password` field too and is not flagged. Mark the line with an `enigma:` note if this one really is a creation form (frontend-policy, security-policy, validation-policy).',
+    severity: "block",
+    skill: "frontend-policy"
+  },
   {
     id: "fe-password-reveal-hand-rolled",
     label: "Password reveal toggled by hand",
@@ -1099,7 +1124,7 @@ var BUILTIN_RULES = [
     // `u` (not the default `i`): the escapes above are code-point escapes, which only
     // mean that with the unicode flag on.
     flags: "u",
-    message: 'Flag emoji. There is no font fix for this and it is not a style preference: Windows has never shipped country flags in its emoji font, so this renders as two bare letters ("ES") for most desktop readers, and iOS, Android, macOS and Linux each draw a different one. Render a flag as an IMAGE: `enigma add flags` (@enigmax/primitives) is `<Flag code="es" />`, which serves the rectangular set (lipis/flag-icons) or the round one (HatScripts/circle-flags) from a CDN, or from files it downloads into the project with `--flags local`. It also accepts the emoji you are replacing as its `code`, so a migration is the component and nothing else. In terminal output, a commit or a log line, drop the flag entirely rather than replacing it - a country name is the information, the glyph never was.',
+    message: 'Flag emoji. There is no font fix for this and it is not a style preference: Windows has never shipped country flags in its emoji font, so this renders as two bare letters ("ES") for most desktop readers, and iOS, Android, macOS and Linux each draw a different one. Render a flag as an IMAGE: `enigma add flags` (@enigmax/primitives) is `<Flag code="es" />`, and serves the rectangular, square or round artwork from enigma over a CDN - or from files it downloads into the project with `--flags local`. It also accepts the emoji you are replacing as its `code`, so a migration is the component and nothing else. In terminal output, a commit or a log line, drop the flag entirely rather than replacing it - a country name is the information, the glyph never was.',
     severity: "block"
   },
   // NOTE: there is deliberately no "Save button with no dirty check" rule, even though
@@ -1723,6 +1748,22 @@ var PROJECT_CHECKS = {
     return !("prisma" in pkg || "@prisma/client" in pkg);
   }
 };
+var CURRENT_PASSWORD = /autocomplete\s*=\s*["'{\s]*current-password/i;
+var NEW_PASSWORD = /autocomplete\s*=\s*["'{\s]*new-password/i;
+var NEW_PASSWORD_PROP = /(?:^|\s)(strength|generate|breach)(?:\s*=|\s*\}|\s*\/?>|\s|$)/;
+var NOT_A_JSX_PROP = /\b(?:const|let|var|function|import|export|interface)\b/;
+function newPasswordAffordanceOnSignIn(content) {
+  if (!CURRENT_PASSWORD.test(content) || NEW_PASSWORD.test(content)) return [];
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line) || NOT_A_JSX_PROP.test(line)) continue;
+    const match = NEW_PASSWORD_PROP.exec(line);
+    if (match) out.push({ line: i + 1, detail: `${match[1]} on a sign-in form` });
+  }
+  return out;
+}
 var FILE_CHECKS = {
   "proc-windows-hide": (content) => missingWindowsHide(content),
   "fe-server-first-mutation": (content) => serverFirstMutation(content),
@@ -1734,7 +1775,8 @@ var FILE_CHECKS = {
   "ts-import-extension": (content, file) => extensionImports(content, file),
   "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
   "ts-alias-paths": (content, file) => missingPathAlias(content, file),
-  "sec-operator-env-leak": (content) => operatorHomePathLeak(content)
+  "sec-operator-env-leak": (content) => operatorHomePathLeak(content),
+  "fe-new-password-affordance-on-signin": (content) => newPasswordAffordanceOnSignIn(content)
 };
 var FIXERS = {
   "fe-name-input-capitalize": (line, file) => {
@@ -2571,6 +2613,7 @@ export {
   loadRules,
   missingPathAlias,
   missingWindowsHide,
+  newPasswordAffordanceOnSignIn,
   operatorHomePathLeak,
   pageAwaitWithoutBoundary,
   readLedger,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.37.0",
+  "version": "1.37.1",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {